CVE-2026-40193: foxcpp Maddy Mail Server LDAP filter injection in auth.ldap

Executive brief

Maddy Mail Server is an all-in-one email server solution. A vulnerability in its LDAP authentication module allows attackers to manipulate database queries by providing specially crafted usernames during login. This can lead to unauthorized access, the ability to impersonate other users, and the theft of sensitive directory information such as account details and password hashes.

Technical details

The `auth.ldap` module in Maddy Mail Server performs direct string interpolation of user-supplied usernames into LDAP search filters and Distinguished Name (DN) strings using `strings.ReplaceAll()`. Because the input is not escaped using `ldap.EscapeFilter()`, an attacker can inject LDAP filter operators (e.g., `*`, `(`, `)`) via the SMTP (AUTH PLAIN) or IMAP (LOGIN) interfaces. This enables boolean-based blind injection and timing side-channel attacks to enumerate directory structure and extract attribute values (like password hashes). The vulnerability is present in `internal/auth/ldap/ldap.go` and is fixed in version 0.9.3.

Affected products

• foxcpp maddy < 0.9.3

Timeline

• 2026-04-12: advisory: GitHub Advisory published
• 2026-04-13: disclosed
• 2026-04-16: other: Advisory updated

References

• https://api.github.com/users/RealHurrison
• https://github.com/RealHurrison
• https://api.github.com/users/RealHurrison/gists%7B/gist_id%7D
• https://api.github.com/users/RealHurrison/repos
• https://avatars.githubusercontent.com/u/43513000?v=4
• https://api.github.com/users/RealHurrison/events%7B/privacy%7D